feat: enhance logging by redacting sensitive information and update .gitignore for runtime logs

.gitignore

@@ -62,6 +62,9 @@ local_settings.py
 db.sqlite3
 db.sqlite3-journal
 
+# App runtime logs
+app/logs/
+
 # Flask stuff:
 instance/
 .webassets-cache
@@ -180,4 +183,7 @@ cython_debug/
 # data
 data/*
 playlists/*
-docker-compose.yml
+docker-compose.yml
+
+# Local dev config may contain Plex token
+app/config.json

app/config.json

@@ -1,29 +0,0 @@
-{
-    "theme": "auto",
-    "token": "",
-    "server_url": "",
-    "server_scheme": "http",
-    "server_port": "32400",
-    "timeout": 9,
-    "library_name": "",
-    "sync_mode": "local_force",
-    "path_rules": [],
-    "path_mapping": {
-        "mode": "SIMPLE",
-        "simple": [],
-        "regex": {
-            "local_pre": [],
-            "local_post": [],
-            "remote_pre": [],
-            "remote_post": []
-        }
-    },
-    "schedule_mode": "DISABLED",
-    "schedule_cron": "",
-    "schedule_daily_time": "00:00",
-    "schedule_weekly_days": [0],
-    "schedule_weekly_time": "00:00",
-    "schedule_auto_watch": false,
-    "backup_enabled": false,
-    "backup_retention_count": 5
-}

app/utils/config.py

@@ -2,6 +2,25 @@ import json
 import os
 from app.utils.logger import logger
 
+
+def _redact_for_log(value: object) -> object:
+    if not isinstance(value, dict):
+        return value
+    redacted = dict(value)
+    for key in ("token", "password"):
+        if key in redacted and redacted.get(key):
+            redacted[key] = "***"
+    return redacted
+
+
+def _redact_server_config_dict(state: dict) -> dict:
+    if not isinstance(state, dict):
+        return {}
+    redacted = dict(state)
+    if redacted.get("token"):
+        redacted["token"] = "***"
+    return redacted
+
 DEFAULT_SYNC_MODE = "merge_local_primary"
 LOCAL_PLAYLISTS_FOLDER = "playlists"
 DEFAULT_PATH_MAPPING = {
@@ -62,7 +81,7 @@ class ServerConfig:
         try:
             with open(CONFIG_PATH, "r", encoding="utf-8") as f:
                 config = json.load(f)
-            logger.debug(f"Loaded server config: {config}")
+            logger.debug(f"Loaded server config: {_redact_for_log(config)}")
         except FileNotFoundError:
             # 如果配置文件不存在，使用默认值
             self.save()
@@ -110,7 +129,7 @@ class ServerConfig:
         self.backup_enabled = config.get("backup_enabled", False)
         self.backup_retention_count = config.get("backup_retention_count", 5)
         logger.info(f"Server config loaded.")
-        logger.debug(f"Current server config: {self.__dict__}")
+        logger.debug(f"Current server config: {_redact_server_config_dict(self.__dict__)}")
 
     def save(self):
         _ensure_parent_dir(CONFIG_PATH)
@@ -137,7 +156,7 @@ class ServerConfig:
         with open(CONFIG_PATH, "w", encoding="utf-8") as f:
             json.dump(config, f, indent=4, ensure_ascii=False)
         logger.info(f"Server config saved.")
-        logger.debug(f"Saved server config: {config}")
+        logger.debug(f"Saved server config: {_redact_for_log(config)}")
 
     def set_url(self, url: str) -> None:
         self.url = url

app/utils/plex_client.py

@@ -79,9 +79,7 @@ class PlexClient:
             # Update the base URL and connection status
             self.base_url = build_plex_url(scheme, url, port)
             self.connected = True
-            logger.info(
-                f"Connected to Plex server at {self.base_url} with token: {self.token}"
-            )
+            logger.info(f"Connected to Plex server at {self.base_url}.")
             return self.server, self.token
         except Exception as e:
             logger.warning(f"Failed to connect to Plex server: {str(e)}")
@@ -106,9 +104,7 @@ class PlexClient:
         self.token = account.authenticationToken
 
         self.server = PlexServer(self.base_url, self.token, timeout=timeout)
-        logger.debug(
-            f"Connected to Plex server with username: {username}, token: {self.token}"
-        )
+        logger.debug(f"Connected to Plex server with username: {username}.")
         return self.server, self.token
 
     def _connect_with_token(
@@ -124,7 +120,7 @@ class PlexClient:
         self.base_url = build_plex_url(scheme, url, port)
 
         self.server = PlexServer(self.base_url, token, timeout=timeout)
-        logger.debug(f"Connected to Plex server with token: {token}")
+        logger.debug("Connected to Plex server with token.")
         return self.server, token
 
     def _connect_check(self):